Programmable logic devices (PLDs) exist as a well-known type of programmable integrated circuit (IC) device (“programmable device”) that may be programmed by a user to perform specified logic functions. There are different types of programmable logic devices, such as programmable logic arrays (PLAs) and complex programmable logic devices (CPLDs). One type of programmable logic device, known as a field programmable gate array (FPGA), is very popular because of a superior combination of capacity, flexibility, time-to-market, and cost.
An FPGA typically includes an array of configurable logic blocks (CLBs) surrounded by a ring of programmable input/output blocks (IOBs). The CLBs and IOBs are interconnected by a programmable interconnect structure. The CLBs, IOBs, and interconnect structure are typically programmed by loading a stream of configuration data (known as a bitstream) into internal configuration memory cells that define how the CLBs, IOBs, and interconnect structure are configured. An FPGA may also include various dedicated logic circuits, such as memories, microprocessors, digital clock managers (DCMs), and input/output (I/O) transceivers.
Programmable devices, such as FPGAs, can include decryption circuitry on-chip in order to process bitstreams that have been encrypted to provide design security. Without knowledge of the appropriate encryption key, it is difficult to analyze a bitstream in order to understand or clone the design. As a further security measure, programmable devices may include authentication logic that can be used to detect whether an encrypted bitstream (or any bitstream) has been altered.
Notably, a bitstream may include various fields that generally contain both configuration data and instructions for modifying registers in the configuration logic of the programmable device. The instructions may include setting the configuration rate, setting a startup sequence, and the like. Configuration logic in a programmable device may include various registers that implement command and control of the configuration process, where the values of such registers can be set using the instructions in the bitstream. One current bitstream authentication mechanism involves authenticating the bitstream before the device is activated, but after the instructions have been executed. That is, the instructions in the bitstream take effect as soon as they are encountered by the configuration logic. As a result, an attacker can tamper with the instructions in the bitstream in an attempt to defeat the authentication and encryption mechanisms and gain access to the design.
Accordingly, there exists a need in the art for a method and apparatus for authenticating a bitstream used to configure programmable devices that overcomes the aforementioned deficiencies.